Riskcovery

CVE-2026-53281

iommu/vt-d: Avoid NULL pointer dereference or refcount corruption

State
Published
Severity
8.8 High
Published
Jun 26, 2026
Updated
Oct 21, 2026
Reserved
Jun 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Avoid NULL pointer dereference or refcount corruption

Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE") fixed a NULL pointer dereference in an unlikely situation partly.

If dev_pasid is not found in the dev_pasids list, it remains NULL. However, the teardown operations are executed unconditionally, this lead to a NULL pointer dereference or refcount corruption.

If the domain was never attached to this IOMMU, info will be NULL, which would cause an immediate dereference when checking --info->refcnt.

Even if info is not NULL, decrementing the refcount without having removed a valid PASID might unbalance the count. This could lead to premature dropping of the refcount to 0, potentially causing a use-after-free for the remaining active devices sharing the domain.

Fix it by returning early if dev_pasid is NULL, before executing the teardown operations.

Issue found by AI review and suggested by Kevin Tian. https://sashiko.dev/#/patchset/20260421031347.1408890-1-zhenzhong.duan%40intel.com

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HLinux
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hredhat-SADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 68ec78beb4a3fb0877cbaaf49758c85410c05977 to before d1a677f9c5e02c4ae49614044ac21296660d1391Affected
  • 60f030f7418d3f1d94f2fb207fe3080e1844630b to before 9022cb9ac0c2a72a57fa8ebf92ac74f953ca0153Affected
  • 60f030f7418d3f1d94f2fb207fe3080e1844630b to before cdfe3c9f2c9e28a8651ee463c88ad191ced2f840Affected
  • 60f030f7418d3f1d94f2fb207fe3080e1844630b to before 79ea2feb917b05366b49d85573c9c5331f043b2cAffected
  • df96876be3b064aefc493f760e0639765d13ed0dAffected
  • 6.12.57 to before 6.12.114Affected
  • 6.13.3 to before 6.14Affected
LinuxLinux
  • 6.14Affected
  • before 6.14Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.18.33 through 6.18.*Not affected
  • 7.0.10 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.